Fortellis,
feature by feature

1. How Fortellis works

Fortellis calls itself the Automotive Commerce Exchange. In its own key concepts there are three kinds of members: API Publishers, who put a service in front of DMS data and describe it with a spec; App Publishers, who build products on those APIs; and App Consumers, the dealers and service providers who activate apps. Today the public API side is CDK alone, and the app side is hundreds of independent vendors.

2. Calling an API

Every request needs two things: an OAuth bearer token and an active Subscription-Id, which is created when a dealer activates your app and the API publisher accepts the connection (authorizing requests). DMS APIs also take a Department-Id that names the dealer's DMS account, and a Request-Id for tracing.

curl https://api.fortellis.io/cdk/drive/customer/v2/bulk \
  -H 'Authorization: Bearer <token>' \
  -H 'Subscription-Id: <subscriptionId>' \
  -H 'Department-Id: <deptId>' \
  -H 'Request-Id: <uuid>'

• Auth flows: client credentials (the usual server-to-server choice), authorization code with refresh tokens, and implicit. API publishers can also front their own API with custom OAuth, Basic auth or a key and secret (authorization on Fortellis).
• Read patterns: most CDK Drive APIs offer bulk (a snapshot, often limited to the last 31 days), delta (changes in the last 24 to 48 hours), lookups by id, and separate history setup APIs for anything older than 31 days.
• Long operations: big reads return an operation id; you poll /long-operations/{id}/status and fetch /result. Responses can stream, with timeouts up to 15 minutes on some APIs.
• Freshness: each API states a data refresh rate, from 15 minutes (repair orders, appointments, parts sales) to 24 hours (employees, op codes, vendors).
• Errors come as a code that says whose fault it is, such as SUBSCRIPTION-MISMATCH, DEPARTMENT-MISMATCH, QUOTA-EXCEEDED, TOKEN-EXPIRED or TARGET-SYSTEM-TIMED-OUT (error codes).
• Versioning: semantic versions, with the major version in the path so old and new run side by side (versioning guide).

3. Field-level data control

The most transferable idea on the platform is API Data Management, in two steps:

• Field Management: the app publisher picks the fields its app receives from an API and marks each one required or optional.
• Field Filtering: the dealer then narrows that list per subscription, which means per location or department. A dealer can even switch off a "required" field, and then has to sort it out with the vendor.

The API publisher learns about every selection through an Admin API notification. That gives dealers a visible, per-store answer to "what can this app see?". Our own tools should offer the same answer.

4. Events and webhooks

Async APIs follow AsyncAPI. A publisher posts events to Event Relay on named channels (for example repair-order-open and repair-order-close), and Event Relay posts them to each subscriber's webhook at {host}/event/{channel}. CDK's API pages link async APIs for open and closed repair orders, service appointments and open and closed parts sales, though these don't appear in the anonymous directory.

• Delivery: at least once, so de-duplicate on the Fortellis-Event-Id header. A webhook answers 202 Accepted; anything else is retried with exponential backoff (message delivery).
• Ordering: guaranteed only for events sharing a partitionKey, such as a store id. One failing message holds back later ones with the same key.
• Verification: each delivery carries a Fortellis-signed JWT whose subject is your API key, with audience api_providers, plus a Data-Owner-Id naming the dealer organization that owns the data (webhook guide).

5. Tools for API publishers

• Specs in OpenAPI 2.0 (REST, SOAP via registration) or AsyncAPI, linted against Fortellis rules.
• An Admin API with callbacks for subscription requests (accept or reject through a connection callback), deactivations, connection updates such as changed Department-Ids, and field selections. Without it, connections complete automatically or by hand.
• Subscription-specific configuration values per dealer, usage reports, performance metrics and error lists, and an API call tester.
• Pricing plans, private plans for named organizations and dealer-group pricing (next section).

6. Pricing, certification and fees

API pricing plans

Publishers choose from four plan types (pricing plans):

• Free, with a low monthly quota.
• Transactional: pay per call, up to five tiers.
• Subscription: a fixed monthly rate per dealership location, optionally with free calls to try it.
• Subscription with overages: up to four public tiers (Basic, Essentials, Plus, Pro). Endpoints can be grouped into "containers", each with its own quota and per-call overage, and some endpoints can be free. CDK uses this type for most of its APIs.

App certification and listing

• Registering an app gives a 30-day free trial of its APIs. Once Fortellis sets a certification date, the trial extends to 60 days. Then a one-time, non-refundable certification fee is charged (certification stages).
• Adding an API after certification means recertifying and paying again.
• Listing a certified app in the marketplace carries a monthly listing fee. Fortellis sets it and can change it with 60 days' notice (listing fee). The fee amounts sit in the publishing agreement and aren't public.
• Payment is by card or US bank account (ACH). In the marketplace data, only 40 of 479 listings show a billing plan and only 14 show a price above zero; almost all are "activate only", meaning the dealer buys from the vendor and turns on the connection in Fortellis.

7. The 36 public APIs

All are published by CDK teams (Data Services, Vehicle Sales and Fortellis Development). Prices are the listed monthly plan prices; per-call overages and quotas differ per plan and are covered in section 8. "Repair Order Bundle" APIs are sold only as a bundle.

Taken together, the public surface is mostly read: customers, employees, vehicle sales and F&I deals, F&I products, "we owe" items, parts sales and inventory, repair orders, appointments, labor types, op codes, vendors and make and model tables. Writes are limited to CDK CRM (leads, customers, opportunities, activities, email), CDK Drive customers, and the repair order bundle, which can create and update ROs and their service lines.

8. What polling costs

Quotas make polling frequency the biggest cost lever. Here's a hand-worked example on CDK Drive Get Repair Order, using its listed Plus plan: $770 a month including 1,440 delta calls, then $1.09 per extra delta call; Pro is $5,100 with 14,400 delta calls and $0.79 overage. Bulk calls are $6 each on every plan, and history requests are $25 each. We assume one subscription per rooftop and a 30-day month.

Polling faster than the 15-minute refresh rate buys nothing but cost. A tool serving many AI builders should poll each rooftop once, at the refresh rate, and fan the changes out to every builder, or subscribe to async events where those are offered.

9. The marketplace in numbers

• 479 apps from 421 vendors. Most vendors list one app; CDK lists about a dozen under its own names (CDK Global, CDK Text Connect and others).
• 324 apps work with CDK Drive (the DMS), 110 with CDK CRM; 4 work with both.
• 109 listings say they write back into the DMS or CRM, for example by posting leads, creating ROs or logging activities. The rest read.
• Growth: new app registrations by year are below, with how many make AI central.

2026 counts are year to date, through October 16.

10. Every feature type

Each app has one primary feature and up to three secondary ones. "Primary" counts each app once; "any" also counts secondary features; "AI" counts apps with that primary feature where AI is central.

The pattern is lopsided. Lead response, texting, marketing and dashboards are crowded. F&I, desking, accounting, parts, title and compliance tools are thin, which matches what the public APIs expose: deal and accounting data are mostly read-only, and there is no public write path for deals at all.

11. Where AI shows up

98 apps from 89 vendors make AI a core part of the product. Most of them do one of four jobs:

1. AI BDC and lead response: agents that text and email new CDK CRM leads within seconds, follow up for months and book showroom appointments (for example DealFlo, Matador, Conversica, Impel, Numa).
2. AI voice agents: answering sales and service calls and booking appointments into the DMS (for example STELLA Automotive AI, Volsae, Pam AI, Toma, CDK's own AIVA).
3. Analytics assistants: dashboards over DMS data with plain-English questions and summaries.
4. Narrow checks: trade-in appraisal, warranty claim review, CSI calls, review replies and service upsell suggestions.

Listings for these apps repeat the same promises: honor do-not-call and do-not-text flags, write every message back to the CRM record, escalate to a human, and never quote a price. Those are the rules an AI tool in this vertical needs to enforce by itself, not leave to its customers.

12. What data apps touch

From each listing's own description, the data an app says it reads or uses, and how many say they write it back:

Customers and repair orders are the two most-used objects. Writes cluster on customers, CRM leads, appointments and repair orders, which are the only places the public APIs allow writes.

13. All 421 vendors

Every marketplace app, sorted by vendor. The summary is the vendor's own one-line description; feature and AI labels are ours. Vendor links go to the website each vendor gave in its listing. The same data is available as JSON for other builders.

14. Lessons for building tools AI builders will use

1. Copy field filtering. Let the app declare the fields it needs, let each rooftop narrow them, and show the result. It is the clearest answer to a dealer's privacy question, and the Safeguards Rule makes dealers ask it.
2. Price around the poll. CDK's quotas mean a builder polling every 5 minutes pays several times what a builder polling at the refresh rate pays. A shared layer that reads once per rooftop and fans out events saves every builder that cost.
3. Treat bulk as rare. At $6 a bulk call and $25 a history request, backfills should be planned jobs, cached and reused, never a step in an agent's loop.
4. Use the event model they already teach. Builders on Fortellis already know at-least-once delivery, event ids, partition keys per store and signed deliveries. Offer the same shape (see our API design).
5. Fill the empty shelves. F&I, accounting, parts, title and compliance have few apps. AI that checks, reconciles or prepares documents there faces less competition, though the read-only APIs limit what it can do automatically.
6. Build the guardrails in. Consent flags, write-back of every message, human escalation and "never quote a price" appear in listing after listing. An MCP server or API that enforces them once spares every AI builder from re-implementing them.
7. Plan for certification time and cost. Every API added after certification means recertifying, so pick the API set for a pilot deliberately.

15. Method and limits

• On October 16, 2026 we fetched the marketplace's public app listing feed (all 479 apps), the anonymous API directory and each API's public detail record (specs, plans, refresh rates), and about 30 documentation pages. Nothing behind sign-in was accessed.
• Each app was classified from its own listing text into one of 31 feature labels, plus AI and data flags, by AI models working under a fixed rubric, then spot-checked by hand. Expect some labels to be arguable; several listings are vague. "AI central" means the listing names AI as core, not that we tested it.
• Vendor counts are distinct publisher names as listed; a few vendors appear under slightly different spellings.
• List prices and quotas are copied from the directory's plan records. How quotas apply across rooftops and how contracts differ is not stated publicly, so the cost table is an estimate.
• Not covered: private APIs and bundles, async API pricing, certification and listing fee amounts, and vendors' actual integration depth.

Read next: CRM and dealer systems for AI builders for the wider DMS map and our proposed design, and AI business models for why integration terms are commercial terms.